Passkeys Now Carry 36% of Sign-Ins and Beat Passwords on Success Rate
FIDO's October Passkey Index puts the estimated number of passkeys in use at seven billion, with sign-ins far more likely to succeed than password-plus-MFA.
Key takeaways
- Passkeys account for 36% of successful sign-ins across 15 consumer services, up from 26%, per secondary summaries of the FIDO Passkey Index.
- Passkey sign-ins succeed 93% of the time versus 78% for passwords and traditional MFA.
- FIDO estimates seven billion passkeys in use, up from five billion in May 2026.
The FIDO Alliance's October 2026 Passkey Index reports that passkeys now account for 36% of successful sign-ins across the 15 consumer services it tracks, up from 26% earlier. The group also estimates seven billion passkeys are in use worldwide, up from five billion in May.
The numbers
The headline figures, as summarised by identity-industry analysts reading the report, are about sign-ins rather than accounts. Passkeys completed 93% of attempts successfully, compared with 78% for passwords and traditional multi-factor methods. The difference is mundane but meaningful: fewer forgotten passwords, expired SMS codes and failed resets mean fewer abandoned logins and fewer support tickets.
Analysts also flagged a narrower metric. One blog's teaser cited 42% of eligible accounts using passkeys, but we could not confirm that in the report, so we leave it out. The distinction between sign-ins and accounts matters: a minority of users who are heavy repeat visitors can lift the sign-in share well above the share of accounts that have enrolled.
Why passkeys are phishing-resistant
A passkey is a cryptographic key pair. The private key stays on the user's device, or syncs through the platform's keychain, and the server stores only the public key. When signing in, the device signs a challenge that is bound to the site's real domain. A look-alike phishing page cannot receive a valid response, and there is no shared secret to steal from a database or intercept as a code. That is the main reason security teams push the technology, beyond convenience.
What remains hard
FIDO's May 2026 consumer and workforce report found 90% of consumers familiar with passkeys and 75% having enabled them on at least one account, yet only 49% use them whenever possible or most of the time. A summary also said 68% of organisations are implementing passkeys for employees. The gap shows up in recovery flows: if account recovery falls back to email links or SMS, attackers target that weaker path instead.
The business case behind the percentages
Passkeys spread for reasons beyond security. Apple, Google and Microsoft all let users sync passkeys through their account keychains, which removes the old objection that a lost phone means a lost login. Password managers added support too, so users who prefer a third-party vault can keep it. Retailers and banks, for their part, treat login friction as lost revenue. A sign-in that succeeds 93% of the time rather than 78% means fewer abandoned checkouts and fewer calls to the help desk for password resets. When the commercial arithmetic and the security benefits point the same way, adoption tends to move faster than a pure compliance mandate would achieve.
The Register's reporting in late 2025 framed passkeys as a replacement for SMS one-time codes, which are the weakest common form of multi-factor authentication because they can be intercepted through SIM-swapping or relayed by phishing kits. Moving high-risk accounts from codes to passkeys closes off a whole family of attacks that rely on tricking users into handing over a six-digit number. Identity attacks remain a leading route into organisations, so removing the shared secret is among the most cost-effective defensive changes available.
For zero-trust programmes, passkeys also provide a stronger anchor for device and user identity. Policies that decide whether to grant access based on who is asking and from which device are only as reliable as the login that feeds them. Phishing-resistant authentication makes the rest of the policy engine more trustworthy, and it reduces the volume of stolen-session and credential-stuffing alerts that analysts must triage.
The caveat is that enrolment, not capability, is the limit. A large share of sign-ins on the most popular services is not the same as a broad base of users; FIDO's own survey shows that fewer than half of consumers choose passkeys when given the option. Organisations that want the security benefit must nudge users with default prompts at login, retire weaker methods for sensitive actions, and make recovery as strong as the primary login.
What to watch
- Whether the sign-in share keeps climbing, and how it compares with the share of enrolled accounts.
- Hardening of recovery flows, the likely next phishing target.
- Enterprise rollouts that replace SMS codes for workforce logins.
Sources
- FIDO Passkey Index 2026: passkeys now carry 36% of sign-ins — Start With Identity
- Passkey Index October 2026 — FIDO Alliance
- The State of Passkeys 2026: Global Consumer and Workforce Report — FIDO Alliance
- Death to one-time text codes: Passkeys are the new hotness in MFA — The Register
